2 ms·
That is out of scope of the service. What kind of user agent the actual user deputizes to interact with a service, is the user's own choice and responsibility.
by TeMPOraL 1y ago
That is out of scope of the service. What kind of user agent the actual user deputizes to interact with a service, is the user's own choice and responsibility. In general, it's not something a service can solve on their end.
- arnarbi 1y agoServices can certainly make this safer by providing means to get more restricted credentials, so that users can deputize semi-trusted delegates, such as agents vulnerable to injection. The important point being made in this discussion is that this is already a common thing with OAuth, but mostly unheard of with web sessions and cookies.